Title II of the Health Insurance Portability and Accountability Act (HIPAA) includes a Privacy Rule. The HIPAA Privacy Rule regulates the use and disclosure of certain information held by “covered entities” including health insurers, medical service providers and others that engage in certain transactions. The Privacy Rule establishes regulations for the use and disclosure of Protected Health Information (PHI) regarding health status, provision of health care, or payment for health care associated with an individual or patient. PHI covers, among other information, any part of an individual's medical record or payment history. A covered entity may disclose PHI to facilitate treatment, payment, or health care operation or if the covered entity has obtained authorization from the individual.
Additionally, when a covered entity discloses any PHI, it must make a reasonable effort to disclose only the minimum necessary information required to achieve its purpose. Increasingly, many patients, especially patients with chronic conditions that require daily management, such as diabetes, participate in health care management plans that include using software to manage, monitor, log, update and transfer data to a health management service or a participating health provider. Typically, a user (patient or health professional) interacts with software provided by the health management service or other health professional. The software can be in the form of an application or program which resides in a computer device (PC, laptop, tablet, smartphone or other handheld device) of the user or communicates with a web service of a health management service or provider by means of a web browser of the user. When an error occurs during the use of the application, the user can communicate by telephone or e-mail, or other digital communication with a support service. The support person that receives the call may not, however, be able to reproduce the error to determine the cause of the problem without seeing what the user sees and without tracing the user's actions. Permission to see private information of the user must be sought and saved in an audit log according to the PHI rule of HIPAA. Even when such permission is received, the experience may not be comfortable for the user and support member.
In the exemplary case of patients with diabetes, for example, diabetes is managed primarily by controlling the level of glucose in the bloodstream (bG). This level is dynamic and complex, and is affected by multiple factors including the amount and type of food consumed, and the amount of insulin (which mediates transport of glucose across cell membranes) in the blood. Blood glucose levels are also sensitive to exercise, sleep, stress, smoking, travel, illness, menses, and other psychological and lifestyle factors unique to individual patients. The dynamic nature of blood glucose and insulin, and all other factors affecting blood glucose, often require a person with diabetes to forecast blood glucose levels. Therefore, therapy in the form of insulin or oral medications, or both, can be timed to maintain blood glucose levels in an appropriate range.
Generally, management of diabetes is time-consuming for patients because of the need to consistently obtain reliable diagnostic information, follow prescribed therapy, and manage lifestyle on a daily basis. Diagnostic information, such blood glucose, is typically obtained from a capillary blood sample with a lancing device and is then measured with a handheld blood glucose meter. Interstitial glucose levels can be obtained from a continuous glucose sensor worn on the body. Prescribed therapies can include insulin, oral medications, or both. Insulin can be delivered with a syringe, an ambulatory infusion pump, an insulin patch or combinations thereof. With insulin therapy, determining the amount of insulin to be injected can require forecasting meal composition of fat, carbohydrates and proteins along with effects of exercise or other physiologic states. The management of lifestyle factors such as body weight, diet, and exercise can significantly influence the type and effectiveness of a therapy.
Management of diabetes involves large amounts of diagnostic data and prescriptive data acquired in a variety of ways: from medical devices, from personal healthcare devices, from patient recorded logs, from laboratory tests, and from healthcare professional recommendations. Medical devices include bG meters, continuous glucose monitors, ambulatory insulin infusion pumps, diabetes analysis software, and diabetes device configuration software. Each of these systems generates and/or manages large amounts of diagnostic and prescriptive data. Personal healthcare devices include weight scales, and blood pressure cuffs, exercise machines, thermometers, and weight management software. Patient recorded logs include information relating to meals, exercise and lifestyle. Lab test results include HbA1C, cholesterol, triglycerides, and glucose tolerance. Recommendations by healthcare professionals may include prescriptions, diets, test plans, and other information relating to the patient's treatment.
At the interaction of a patient or health professional with software used by the patient and health professional in the management of diabetes as describe above, software or other application errors can be encountered in association with files, forms or screen views that also include personal, medical and other health information of the patient that is protected by the Privacy Rule of HIPAA (private information).
The present teachings are directed to addressing this problem by accessing a user's web browser session that has been redacted to restrict access to private data of the user, including personal, medical or other protected information of the user.